基于驱动层的USB存储设备安全监控技术

Security Monitoring Technology of USB Storage Device Based on Driver Layer

针对USB存储设备提出基于驱动层安全监控的设计方案。介绍Windows驱动程序模型(WDM)的结构模型,分析Windows系统下经过USB集线设备IRP包的拦截技术,并利用下层过滤驱动和文件系统过滤驱动程序实现对USB存储设备的监控,给出USB存储设备安全监控软件的总体设计。

Aiming at USB storage device, this paper presents a design scheme of security monitoring based on driver layer. It introduces the architecture Of Win32 Driver Model（WDM）, and analyzes the technology of IRP tracking from USB hub device in Windows system and implements to monitor the USB storage device by lower filter driver and file filter driver. It describes the total design of the security monitoring system of USB storage device.